You have issued tens of thousands of smart cards protected by RSA and ECC. A cryptographically relevant quantum computer may still be years away, but the data those cards protect has a much longer shelf life than the math that guards it. If you run a government ID program, an enterprise PKI, or any credential that must stay trusted for a decade or more, the time to plan for post-quantum cryptography (PQC) is now, not after the first quantum machine appears.
Why Quantum Computing Threatens the Cryptography on Your Cards
The threat is not a sudden break. It is a slow one called “harvest now, decrypt later.” An adversary can collect your encrypted traffic and signed records today, store them, and decrypt them the moment a quantum computer with enough stable qubits becomes available. For a national ID, an e-passport, or a long-lived enterprise PKI, that future decryption window is exactly the scenario you are paid to prevent.
The algorithms at risk are the ones your cards already depend on. RSA-2048 and ECC-256 are the workhorses of smart-card authentication and digital signatures, and both are vulnerable to Shor’s algorithm on a sufficiently large quantum machine. Any credential whose protected data must remain secret for 10 to 15 years or more is already exposed to harvest-now, decrypt-later risk, which is why NIST frames PQC migration around the lifetime of the data, not the arrival date of the hardware. A PIV key or eID root compromised in 2035 can be used to forge credentials for the entire remaining life of the program.
How Smart Card Cryptography Works Today
On a contact or dual-interface card, the cryptographic work happens inside the secure element, a tamper-resistant chip that holds your keys and never exposes them. Asymmetric keys (RSA or ECC) handle authentication, digital signatures, and key establishment; symmetric keys (AES, sometimes 3DES) protect data and internal commands. On a PIV card, for example, the PIV authentication key, the digital signature key, the key management key, and the card authentication key are all ECC or RSA pairs issued and certified by your PKI.
That design is what makes the cards trustworthy, and it is also what makes them a target. The very asymmetric keys that authenticate a PIV, eID, or payment credential are exactly the keys a quantum computer would attack first. The good news is that the chip itself is not obsolete; what needs to change is the algorithm running on it. When you choose a chip, the relevant question is no longer only “how many keys and how much memory,” but “can this platform carry a post-quantum algorithm at all.” See our smart card chip selection guide for the memory and interface trade-offs that matter here.
What “Crypto-Agile” Credentials Actually Mean
Crypto-agility is the ability to change the cryptography on a credential without re-issuing the plastic. It is not a feature of the card body; it lives in the card operating system and the applets loaded on top of it. A crypto-agile card can receive a new applet or a new cryptographic library through a secure, authenticated update; it carries enough memory headroom for the larger keys and signatures that PQC requires; and it can run classical and post-quantum algorithms side by side.
Crypto-agility is a property of the card operating system and its applets, not the PVC. A cheap, locked-down OS that can only run the algorithm it shipped with will force a full re-issue the day you need PQC; an algorithm-agile OS lets you push the new crypto to cards already in the field. That distinction is the single most important thing to check before you specify your next card. Our overview of smart card operating systems explains which platforms support post-issuance applet loading and why it matters for migration.
Post-Quantum Algorithms That Belong on a Card
In 2024, NIST finalized the first set of PQC standards, and these are the names you will see in every credible vendor roadmap:
- ML-KEM (FIPS 203), derived from Kyber, for encryption and key establishment.
- ML-DSA (FIPS 204), derived from Dilithium, for digital signatures, the function most cards perform on every authentication.
- SLH-DSA (FIPS 205), derived from SPHINCS+, a stateless hash-based signature scheme kept as a conservative, different-mathematical backup.
- Hybrid schemes that combine a classical algorithm (ECC or RSA) with a PQC algorithm so a credential stays valid even if one is later weakened.
NIST standardized ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in 2024, giving buyers a stable target to specify against (FIPS 203, FIPS 204, FIPS 205). Lattice-based ML-DSA is the default choice for cards because it performs well on constrained chips, but its signatures are far larger than ECDSA, so the chip must have both memory and compute headroom to verify them offline.
Standards and Timelines You Can Plan Against
You do not have to invent a migration plan from scratch; the agencies that run the largest card programs have already published theirs. NSA’s CNSA 2.0 mandates post-quantum cryptography for national security systems, with a phased transition that retires legacy RSA and ECC through the 2030s. For government PIV programs, idmanagement.gov carries the FIPS 201 alignment that your compliance team already tracks. Industry bodies such as GlobalPlatform and the Common Criteria portal are updating their certification schemes to recognize PQC-capable products.
CNSA 2.0 sets a 2035 target for PQC across national-security systems, a useful planning horizon even for commercial programs that do not fall under it. If your credential life plus issue-to-expiry window crosses that date, you should be issuing crypto-agile cards now rather than retrofitting them later. Our PIV and PKI smart card guide covers how FIPS 201-3 credentials map onto these evolving requirements.
How to Specify Crypto-Agility in Your Next RFQ
The cheapest place to make a card quantum-resistant is the specification, before a single card is manufactured. Put these requirements in your next request for quotation:
- Require an algorithm-agile card OS that can load new crypto applets after issuance, not a fixed-algorithm chip.
- Specify memory headroom for PQC public keys and signatures; an ML-DSA signature is roughly 2 to 4 KB versus about 70 bytes for ECDSA, and readers must store and verify it.
- Require hybrid support (classical plus PQC) from day one so existing readers keep working.
- Require a secure applet and firmware update path, and ask exactly who signs those updates.
- Ask for FIPS 140 and Common Criteria evidence plus a written vendor PQC roadmap and timeline.
- Confirm reader and terminal compatibility; offline verification of larger PQC signatures usually needs reader firmware updates you should budget for now.
The Migration Path: From Today’s Cards to Quantum-Resistant Ones
You do not rip out and replace a running card program. The realistic path is incremental and rides your normal re-issue cycle. Issue hybrid credentials that keep ECC or RSA for compatibility with readers already deployed while adding PQC keys and signatures alongside them. Stage applet updates through your card management system so fields cards gain PQC without a truck roll. Update reader firmware on the same schedule you already use for maintenance, and let natural expiry, not a forced big-bang swap, retire the last classical-only cards.
Start with hybrid credentials (classical plus PQC) so today’s readers keep working while you gain quantum resistance. The programs that plan this now absorb the cost across years of normal refreshes; the programs that wait face a forced, unplanned re-issue at the worst possible moment. Our card management systems overview explains how to stage applet updates and re-issue at scale without disrupting daily operations.
What GENUINE Can Do for Your Program
Quantum risk is a planning problem, not an emergency, but the programs with the longest-lived credentials feel it first. GENUINE has built crypto-capable smart cards since 2005, and we can supply algorithm-agile cards and the technical backing to write crypto-agility into your next specification instead of discovering the gap at re-issue time. Ask us for a sample of an algorithm-agile card and a PQC readiness checklist tailored to your program, and we will help you turn this article into a line item in your next RFQ.
